CVE-2024-8764

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service (DoS) condition, as certain regular expressions can cause excessive resource consumption, blocking the server from processing other requests.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	>= unspecified, < 1.4.23

References

https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497faPatch
https://huntr.com/bounties/088c04a1-d23a-47f2-9d7c-b84d7332868dExploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-87657.3In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as CVE-2024-87666.7Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2024-87679.9Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plu CVE-2024-87687.5A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial o CVE-2024-87699.1A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through rela CVE-2024-87706.1A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attac CVE-2024-87714.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-87724.351l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition CVE-2024-87738.3SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vul CVE-2024-87747.7The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges t CVE-2024-87755.5A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a CVE-2024-87766.1SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript